Re: Negative ack slew, window scaling, ...

This is a discussion on Re: Negative ack slew, window scaling, ... within the IPFilter forums, part of the System Security and Security Related category; On Mon, Sep 29, 2003 at 09:36:05AM -0400, Victor.Duchovni@morganstanley.com wrote: > > No. An ack ...


Go Back   Usenet Forums > System Security and Security Related > IPFilter

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 09-30-2003
Guido van Rooij
 
Posts: n/a
Default Re: Negative ack slew, window scaling, ...

On Mon, Sep 29, 2003 at 09:36:05AM -0400, Victor.Duchovni@morganstanley.com wrote:
> > No. An ack can be circling around on the internet for some time.
> > When the ack finally pops up, you can indeed safely ignore it, but it
> > will lead to a blocked packet. So in order to not generate blocks if
> > you do not need to, we set an arbitrary limit.
> >

>
> Old packets have a *positive* ack slew. Negative ack slew is for ACKs that
> are ahead of the highest seq+len from the other side. The reason this is
> possible is that (apparently) the length only takes the first fragment
> into account. Negative ack slew never gets more negative as the packet
> ages (td_end never moves back). Negative ack slew should never exceed the
> MSS (I think).


Indeed. With fragments you just dont know the length of the total
TCP or UDP packet beforehand.

> The comment talks about why negative slew is allowed, but not about why it
> is cumulative or about why it adjusts td_end instead of merely
> compensating for the uncertainty elsewhere (by a allowing a fuzz of order
> 1*MSS in the window).


It is cumulative becausewhen you see one fragment, you will probably
see more fragmented packets. You have to constantly correct for that.

To be homnest, it is about 3-4 years ago I designed this.
The paper should give a better answer ;-)

-Guido
Reply With Quote
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 03:53 PM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0